Security Articles from Wikipedia
Security Articles from Wikipedia
Security Articles from Wikipedia
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Public-key cryptography 104<br />
using the correct public keys for different communication segments in all instances to avoid suspicion. This attack<br />
may seem to be difficult to implement in practice, but it's not impossible when using insecure media (e.g., public<br />
networks such as the Internet or wireless communications). A malicious staff member at Alice or Bob's ISP might<br />
find it quite easy to carry out. In the earlier postal analogy, Alice would have to have a way to make sure that the<br />
lock on the returned packet really belongs to Bob before she removes her lock and sends the packet back. Otherwise,<br />
the lock could have been put on the packet by a corrupt postal worker pretending to be Bob to Alice.<br />
One approach to prevent such attacks is the use of a certificate authority, a trusted third party responsible for<br />
verifying the identity of a user of the system and issuing a tamper resistant and non-spoofable digital certificate for<br />
participants. Such certificates are signed data blocks stating that this public key belongs to that person, company, or<br />
other entity. This approach also has weaknesses. For example, the certificate authority issuing the certificate must be<br />
trusted to have properly checked the identity of the key-holder, the correctness of the public key when it issues a<br />
certificate, and has made arrangements with all participants to check all certificates before protected communications<br />
can begin. Web browsers, for instance, are supplied with many self-signed identity certificates <strong>from</strong> PKI providers;<br />
these are used to check certificate's bonafides (issued properly by the claimed central PKI server?) and then, in a<br />
second step, the certificate of a potential communicant. An attacker who could subvert the certificate authority into<br />
issuing a certificate for a bogus public key could then mount a man-in-the-middle attack as easily as if the certificate<br />
scheme were not used at all. Despite its problems, this approach is widely used; examples include SSL and its<br />
successor, TLS, which are commonly used to provide security in web browsers, for example, to securely send credit<br />
card details to an online store.<br />
Computational cost<br />
Public key algorithms known thus far are relatively computationally costly compared with most symmetric key<br />
algorithms of apparently equivalent security. The difference factor is the use of typically quite large keys. This has<br />
important implications for their practical use. Most are used in hybrid cryptosystems for reasons of efficiency; in<br />
such a cryptosystem, a shared secret key ("session key") is generated by one party and this much briefer session key<br />
is then encrypted by each recipient's public key. Each recipient uses the corresponding private key to decrypt the<br />
session key. Once all parties have obtained the session key they can use a much faster symmetric algorithm to<br />
encrypt and decrypt messages. In many of these schemes, the session key is unique to each message exchange, being<br />
pseudo-randomly chosen for each message.<br />
Associating public keys with identities<br />
The binding between a public key and its 'owner' must be correct, lest the algorithm function perfectly and yet be<br />
entirely insecure in practice. As with most cryptography, the protocols used to establish and verify this binding are<br />
critically important. Associating a public key with its owner is typically done by protocols implementing a public<br />
key infrastructure; these allow the validity of the association to be formally verified by reference to a trusted third<br />
party, in the form of either a hierarchical certificate authority (e.g., X.509), a local trust model (e.g., SPKI), or a web<br />
of trust scheme (e.g., that originally built into PGP and GPG and still to some extent usable with them). Whatever<br />
the cryptographic assurance of the protocols themselves, the association between a public key and its owner is<br />
ultimately a matter of subjective judgment on the part of the trusted third party, since the key is a mathematical entity<br />
while the owner, and the connection between owner and key, are not. For this reason, the formalism of a public key<br />
infrastructure must provide for explicit statements of the policy followed when making this judgment. For example,<br />
the complex and never fully implemented X.509 standard allows a certificate authority to identify its policy by<br />
means of an object identifier, which functions as an index into a catalog of registered policies. Policies may exist for<br />
many different purposes, ranging <strong>from</strong> anonymity to military classification.